• by Wendy Davis  @wendyndavis, January 21, 2020

The Supreme Court on Tuesday left in place a ruling that allows Illinois residents to proceed with a lawsuit accusing Facebook of violating a state biometric privacy law by compiling a database of “faceprints.”

As is customary, the justices didn't give a reason for refusing to hear Facebook's appeal of the lower court ruling. Facebook declined to comment.

The justices' refusal to weigh in means Facebook must now face a class-action alleging that it violated the Illinois Biometric Information Privacy Act.

That 10-year-old statute -- considered one of the strongest privacy laws in the country -- requires companies to obtain written releases from people before collecting “face geometry” and other biometric data. The law provides for damages of up to $5,000 per violation.

The battle dates to 2015, when Illinois residents Carlo Licata, Adam Pezen and Nimesh Patel claimed in a class-action complaint that Facebook's photo-tagging feature violates the state's Biometric Information Privacy Act.

Facebook's photo-tagging function allegedly draws on a vast trove of photos to recognize users' faces and suggest their names when they appear in photos uploaded by their friends.

Facebook unsuccessfully argued to a district court judge and the 9th Circuit Court of Appeals that the lawsuit should be dismissed before trial. Among other arguments, Facebook contended that the Illinois residents weren't injured by the alleged practices, and therefore had no “standing” to proceed in federal court.

A three-judge panel of the 9th Circuit Court of Appeals rejected that reasoning last year.

"The development of a face template using facial-recognition technology without consent (as alleged here) invades an individual's private affairs and concrete interests," Circuit Judge Sandra Ikuta wrote in an opinion joined by Judges Ronald Gould and Benita Pearson.

The judges added that creating facial templates could have far-reaching consequences.

“Once a face template of an individual is created, Facebook can use it to identify that individual in any of the other hundreds of millions of photos uploaded to Facebook each day, as well as determine when the individual was present at a specific location,” the appellate judges wrote. “Taking into account the future development of such technology ... it seems likely that a face-mapped individual could be identified from a surveillance photo taken on the streets or in an office building. Or a biometric face template could be used to unlock the face recognition lock on that individual’s cell phone.”

Facebook then asked the Supreme Court to intervene. The company's request was backed by outside groups including the libertarian think tank TechFreedom, which argued in a friend-of-the-court brief that people shouldn't be able to sue in federal court over “speculative, insubstantial harms.”

Gerry Stegmaier, the lawyer who represented TechFreedom, says the Supreme Court's refusal to hear the case is likely to lead to more court battles.

“The Supreme Court has chosen not to intervene,” Stegmaier says, adding that the refusal will probably result in new cases against tech companies.

“We're likely to see a proliferation of gotcha lawsuits as states continue to fill the federal void and pass new privacy legislation,” says Stegmaier, a partner at the law firm Reed Smith.

Facebook isn't the only company to face litigation over facial-recognition software.

Google was also sued for allegedly violating the Illinois law by deploying facial recognition technology on photos uploaded by users. So far, that matter has had a different outcome than the lawsuit against Facebook.

U.S. District Court Judge Edmond Chang in Illinois dismissed the complaint against Google, ruling that the people who sued didn't suffer any concrete injury from the company's alleged faceprint practices.

Chang said in his ruling that Google's alleged practices didn't cause an injury because people's faces are “public” information.

Stegmaier says the Supreme Court's refusal to hear Facebook's appeal and set a national standard suggests that outcomes of privacy lawsuits will continue to vary based on where the cases are brought.